fix: ignore empty kubeconfig tokens

[nklmilojevic]

A kubeconfig user with token: '' caused kube-client to add an empty bearer header. Treat the empty token as absent before client creation so requests can use the configured client certificate without that header.

Add a local TLS regression test for absent, empty, and non-empty tokens with standard and legacy client certificates, with TLS resumption enabled and disabled. The test failed before the fix and passes after it.

Validation: just check passed, including formatting, Clippy with warnings denied, and the full test suite. This change covers empty tokens only; it does not change whitespace handling or establish the cause of the reported cluster-specific 401.

Closes #637

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the focused authentication fix is applied before all relevant client-building paths and has effective regression coverage.

Summary

This PR treats an empty inline kubeconfig token as absent before constructing the Kubernetes client, preventing an empty bearer header from interfering with client-certificate authentication.

• Preserves non-empty bearer tokens without changing whitespace handling.
• Applies token normalization before both standard and legacy TLS client construction.
• Adds regression coverage for absent, empty, and non-empty tokens across standard and legacy client certificates and both resumption configurations.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Kubeconfig auth info] --> B{Inline token empty?}
  B -->|Yes| C[Remove token]
  B -->|No or absent| D[Preserve token state]
  C --> E[Build standard or legacy TLS client]
  D --> E
  E --> F[Authenticate with client certificate]
  E --> G[Add bearer header only for non-empty token]

Loading

_{Reviews (1) · Last reviewed commit: "fix: ignore empty kubeconfig tokens"}